One thing I wish this mentioned in the "Ugly" section is how allowing Javascript, and to some extent using XML, creates security issues, such as potential XSS (

One thing I wish this mentioned in the "Ugly" section is how allowing Javascript, and to some extent using XML, creates security issues, such as potential XSS (because of javscript), XXE (because of XML), etc. You can avoid vulnerabilities if you're careful. But you have to be careful, and know what to look out for. > Instead you compile it into an PDF (which is also a horrible format and badly bloated, but well) Yeah... PDF might actually be worse in some ways (and it can have javascript too). With SVG, it isn't too hard to be able to use a subset of SVG to generate images. With PDF though, just making a valid, useful PDF is pretty complicated and requires a decent understanding of the spec (which is big). Being able to properly render any valid PDF is probably even worse.